Script to display last password change of computer account.

#written by pan_2.livejournal.com
function Get-DomainComputersLastPasswordChange

    {

    $hComputerAccounts = @{}

    # Use Directory Services object to attach to the domain
    $searcher = new-object DirectoryServices.DirectorySearcher([ADSI]"")
    #Leaving the ADSI statement empty = attach to your root domain

    # Filter down to computer accounts
    # $searcher.filter = "(&(objectClass=computer))"
    $searcher.filter = "(&(objectCategory=computer)(!userAccountControl:1.2.840.113556.1.4.803:=2))"

    # Cache the results
    $searcher.CacheResults = $true
    $searcher.SearchScope = “Subtree”
    $searcher.PageSize = 1000

    # Find anything you can that matches the definition of being a computer object
    $accounts = $searcher.FindAll()

    # Check to make sure we found some accounts
    if($accounts.Count -gt 0)
        {
        foreach($account in $accounts)
            {
            # Property that contains the last password change in long integer format
            $pwdlastset = $account.Properties["pwdlastset"];

            # Convert the long integer to normal DateTime format
            $lastchange = [datetime]::FromFileTimeUTC($pwdlastset[0]);

            # Determine the timespan between the two dates
            $datediff = new-TimeSpan $lastchange $(Get-Date);

            $hComputerAccounts[$account.Properties["name"][0]] = $lastChange
            }
        }

$hComputerAccounts.GetEnumerator() | sort -prop Value | select @{name='ComputerName';Expression={$_.Name}}, @{Name="LastPasswordChange";Expression={$_.value}}
}